Web Security Headers Checker

Overview

Scan HTTP security headers on any site, get an A+–F grade, and copy-paste fixes for Nginx, Apache & Cloudflare.

Web Security Headers Checker scans any website's HTTP security headers and gives you an instant A+ to F grade — the same methodology as securityheaders.com — right from Chrome's side panel or DevTools. What it checks: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy — plus bonus checks for Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and more. Beyond headers — exposed secret detection: Scans the response body for accidentally leaked API keys and credentials (Google API keys, AWS access keys, Stripe secret keys, GitHub tokens, Slack tokens, private key blocks, and more), with redacted previews and rotation guidance. Three ways to scan: • Auto-detect — one click scans your current tab, no typing needed • Live capture — reads the exact headers your browser received on page load • DevTools panel — analyzes the network log directly, including cookie-dependent responses For every issue found: Get copy-paste fix snippets for Nginx, Apache, and Cloudflare (Pages _headers and Transform Rules), plus a one-click Markdown export for audit reports and client deliverables. No account, no tracking, no data leaves your browser except the page you choose to scan. Built by Faiz Azizan — drfaizazizan.com

0 out of 5
No ratings
Learn more about results and reviews.

Details

Version
1.2.0
Updated
July 12, 2026
Flag concern
Size
27.91KiB
Languages
English
Developer
Website
Email
faizazizanxyz@gmail.com
Non-trader
This developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.

Privacy

Manage extensions and learn how they're being used in your organization

The developer has disclosed that it will not collect or use your data. To learn more, see the developer’s privacy policy.

This developer declares that your data is

Not being sold to third parties, outside of the approved use cases
Not being used or transferred for purposes that are unrelated to the item's core functionality
Not being used or transferred to determine creditworthiness or for lending purposes

Security Headers

0.0

Security headers checker with letter grade, severity levels, batch scan, site compare, fix snippets, and shareable report card.

SimpleModHeader

5.0

A lightweight, open-source Chrome extension to modify HTTP request headers. No tracking, no analytics, fully transparent.

HeaderCheck

5.0

Local security header audit. Runs offline. Made by YvonLabs.

VAPT Assistant Pro+

0.0

Advanced VAPT toolkit with AI, security headers, WAF detection, DNS/WHOIS tools, subdomain scanner, and VirusTotal integration.

HTTPS Everywhere

4.0

Automatically redirect to HTTPS version of websites.

Ignore X-Frame headers

4.4

Drops X-Frame-Options and Content-Security-Policy HTTP response headers, allowing all pages to be iframed.

nekuda WebMCP Workbench

5.0

WebMCP devtools + AI assistant: inspect, run, eval and audit your page's tools - then chat with any site through them.

DevHeader - Header Injector & HTTP Header Editor

5.0

Add & edit HTTP request and response headers per site. Fix CORS, set profiles, paste-to-add. No sign-up, no paywall.

Website Framework Detector

5.0

Detect the CMS, builder & tech stack behind any site (WordPress, Shopify, Wix, Webflow…) — 100% local, no tracking.

rep+

5.0

rep+ - Capture, modify, and replay HTTP requests in Chrome DevTools with AI-powered security analysis.

ModHeader Extension: HTTP Header Editor

3.7

Modify headers, cookies and redirects. Add, edit or remove custom HTTP headers. Ad free, local ModHeader alternative.

Security Header Scanner

0.0

Analyze HTTP security headers of any website and get an instant security grade with detailed recommendations.